PT-2009-6554 · Idevspot · Idevspot Isupport

Essandre + 1 · Published 2009-12-28 · Updated 2017-08-17 · CVE-2009-4433

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IDevSpot iSupport versions 1.8 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This can be achieved through various means, including the "5" or "9" field in a post action to "ticket function.php", the "which" parameter to "function.php", or the "which" parameter to "index.php". These endpoints are reachable through "ticket submit.php" and "index.php", and are related to "knowledgebase list.php".

Recommendations For IDevSpot iSupport versions 1.8 and earlier, consider disabling access to the vulnerable endpoints, such as "ticket function.php", "function.php", and "index.php", until a fix is available. Additionally, restrict the use of the "which" parameter and the "5" and "9" fields in post actions to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-4433

Affected Products

Idevspot Isupport

References · 13

• 🔥 https://exploit-db.com/exploits/33412 · Exploit
• 🔥 http://packetstormsecurity.org/0912-exploits/isupport-lfixss.txt · Exploit
• 🔥 https://exploit-db.com/exploits/33411 · Exploit
• 🔥 http://exploit-db.com/exploits/10478 · Exploit
• 🔥 https://exploit-db.com/exploits/10478 · Exploit
• 🔥 http://securityfocus.com/bid/37380 · Exploit
• http://secunia.com/advisories/37726 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4433 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54858 · Note
• http://osvdb.org/61109 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54859 · Note
• http://osvdb.org/61112 · Note
• http://osvdb.org/61111 · Note